No token revocation on deactivate - that would force users to regenerate tokens on reactivation, which admins probably don't want. Middleware refusal is enough because it fires on every request.
Updated the pattern check to use `stripos(...) === 0` (prefix match) instead of !== false (substring match), so scripted clients identify themselves at position 0, and prefix matching prevents a pattern from accidentally matching an unrelated UA that mentions it later. This makes surwe a UA like MyWrapper/1.0 (uses curl/8.5.0 internally) passes, and a plain curl/8.5.0 is blocked.
Get setting + UA.
2. If UA is blank, block if blank-blocking is on, otherwise pass.
3. Past this point UA is known non-blank.
4. If pattern master is off, pass.
5. Iterate patterns, reject on first match.
6. Pass.
Side benefit: the if ($patterns === [] || $userAgent === '') short-circuit is gone — both conditions are unreachable by this point (UA is non blank by step 2; an empty pattern list just makes the foreach a no-op).
https://github.com/snipe/snipe-it/pull/14702/files introduced a bug
where instead of doing a quick `select count(*)` of assets, it did a `select *` of
assets, moving the count from the database to the PHP process.
This caused OOM issues in memory-constrained environments with lots of
assets, and also presented a speed issue even when memory limited were
increased.
Additionally, given this populates the sidebar, this was likely an issue
on every page load that included the sidebar.
The fix is simply removing the `all()->`, ending up with Asset::count(),
which yields the desired `select count(*)` DB query.
The total asset count in the sidenav shows the ready to deploy count instead of the total count.
Fix this by adjusting the query to all assets. Also respect the setting for archived assets.
Add a default value for total assets, since we are now using the settings-variable, which is not available during the setup process.
While at it, move the block for total assets before the ready to deploy assets to match the ordering of the sidenav.
Signed-off-by: Tobias Regnery <tobias.regnery@gmail.com>
